Overview

overview

10

Static

static

5154b71190...6c.dll

windows7-x64

10

5154b71190...6c.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    26-09-2022 15:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5154b7119040fa55cec1d27f9a5f396c.dll

  • Size

    278KB

  • MD5

    5154b7119040fa55cec1d27f9a5f396c

  • SHA1

    eff56bdb7455dfdeb87c997d8d671587f328b402

  • SHA256

    7d0f80026a49bdc5c9e6b6bb614b37a9edbb0ca50127c7078ff52d4fc729afa8

  • SHA512

    2b55c68fdcec9b2ee9173dd9cba4c7148bb12bff180b5983aadfb098e87ff87f5774c08fd133d8ed78f67c00bf56accf2b79839368f674715f8d624ddad950bc

  • SSDEEP

    6144:vj60AAaYK4lqro1fTfwo410AYSwpt3kIh/P+Jjdn9prrK:e0AAaYK4lw3omgRkIh/a191K

Score
10/10
icedid81003051bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

81003051

C2

satisfyammyz.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Blocklisted process makes network request 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\5154b7119040fa55cec1d27f9a5f396c.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1700-54-0x0000000180000000-0x0000000180009000-memory.dmp
    Filesize

    36KB

    Download